@ornncompute/cli 0.2.24 → 1.0.25

package/src/auth-store.mjs

@@ -1,7 +1,9 @@
 import { readFileSync } from "node:fs";
-import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
+import { mkdir, readFile, rm } from "node:fs/promises";
 import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { writeAtomicOutput } from "./atomic-output.mjs";
 
 const APP_DIR = "ornn";
 const AUTH_FILE = "auth.json";
@@ -46,6 +48,15 @@ export function configuredApiBaseUrl(env = process.env) {
   }
 }
 
+export function configuredInstallerBaseUrl(env = process.env) {
+  try {
+    const value = JSON.parse(readFileSync(getCliConfigPath(env), "utf8"))?.installerBaseUrl;
+    return typeof value === "string" ? value.trim() : "";
+  } catch {
+    return "";
+  }
+}
+
 export async function loadAuthSession({ env = process.env } = {}) {
   const path = getAuthConfigPath(env);
 
@@ -60,20 +71,180 @@ export async function loadAuthSession({ env = process.env } = {}) {
   }
 }
 
-export async function saveAuthSession(session, { env = process.env, now = new Date() } = {}) {
+async function writeAuthSession(session, env) {
   const path = getAuthConfigPath(env);
+  await mkdir(getAuthConfigDir(env), { recursive: true, mode: 0o700 });
+  await writeAtomicOutput(path, `${JSON.stringify(session, null, 2)}\n`, {
+    mode: 0o600,
+    overwrite: true,
+  });
+  return session;
+}
+
+export async function saveAuthSession(session, { env = process.env, now = new Date() } = {}) {
+  const existing = await loadAuthSession({ env });
+  const payload = { ...session };
+  delete payload.pendingPurchase;
+  delete payload.pendingWorkspace;
+  delete payload.recoveryUserId;
+  const userId = pendingString(session?.user, "id");
+  const existingOwnerId = recoveryOwnerId(existing);
+  const existingRecovery =
+    userId && existingOwnerId === userId
+      ? durableRecoveryFields(existing)
+      : !userId && existingOwnerId
+        ? durableRecoveryFields(existing)
+        : {};
+  const suppliedRecovery = userId ? durableRecoveryFields(session) : {};
+  const retainedRecoveryOwnerId =
+    !userId && Object.keys(existingRecovery).length > 0 ? existingOwnerId : null;
+  return writeAuthSession(
+    {
+      ...payload,
+      ...existingRecovery,
+      ...suppliedRecovery,
+      ...(retainedRecoveryOwnerId ? { recoveryUserId: retainedRecoveryOwnerId } : {}),
+      savedAt: now.toISOString(),
+    },
+    env
+  );
+}
+
+export async function bindAuthUser(user, { env = process.env, expectedAccessToken } = {}) {
+  const userId = pendingString(user, "id");
+  if (!userId) return false;
+  const existing = await loadAuthSession({ env });
+  if (
+    !existing?.accessToken ||
+    (expectedAccessToken && existing.accessToken !== expectedAccessToken)
+  ) {
+    return false;
+  }
   const payload = {
-    ...session,
-    savedAt: now.toISOString(),
+    ...existing,
+    user: { ...(existing.user ?? {}), ...user, id: userId },
   };
+  const ownerId = recoveryOwnerId(existing);
+  if (ownerId && ownerId !== userId) {
+    delete payload.pendingPurchase;
+    delete payload.pendingWorkspace;
+  }
+  delete payload.recoveryUserId;
+  await writeAuthSession(payload, env);
+  return true;
+}
 
-  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-  await writeFile(path, `${JSON.stringify(payload, null, 2)}\n`, {
-    encoding: "utf8",
-    mode: 0o600,
-  });
+export async function saveOrganizationHint(
+  selectedOrganizationId,
+  { env = process.env, expectedAccessToken } = {}
+) {
+  const session = await loadAuthSession({ env });
+  if (
+    !session?.accessToken ||
+    (expectedAccessToken && session.accessToken !== expectedAccessToken)
+  ) {
+    return null;
+  }
+  const payload = { ...session };
+  if (typeof selectedOrganizationId === "string" && selectedOrganizationId.trim()) {
+    payload.selectedOrganizationId = selectedOrganizationId.trim();
+  } else {
+    delete payload.selectedOrganizationId;
+  }
+  return writeAuthSession(payload, env);
+}
+
+function pendingString(value, field) {
+  return typeof value?.[field] === "string" ? value[field].trim() : "";
+}
 
-  return payload;
+function pendingWorkspaceValue(value) {
+  const pending = value && typeof value === "object" ? value : {};
+  const required = [
+    "id",
+    "organizationId",
+    "reservationId",
+    "keyId",
+    "networkId",
+    "volumeId",
+    "mountAccess",
+  ];
+  const normalized = Object.fromEntries(
+    required.map((field) => [
+      field,
+      typeof pending[field] === "string" ? pending[field].trim() : "",
+    ])
+  );
+  if (required.some((field) => !normalized[field])) return null;
+  return {
+    ...normalized,
+    username:
+      typeof pending.username === "string" && pending.username.trim()
+        ? pending.username.trim()
+        : null,
+  };
+}
+
+function durableRecoveryFields(value) {
+  const pendingWorkspace = pendingWorkspaceValue(value?.pendingWorkspace);
+  return {
+    ...(pendingWorkspace ? { pendingWorkspace } : {}),
+  };
+}
+
+function recoveryOwnerId(value) {
+  return pendingString(value?.user, "id") || pendingString(value, "recoveryUserId");
+}
+
+export async function loadPendingWorkspace({ env = process.env, session: suppliedSession } = {}) {
+  const session = suppliedSession === undefined ? await loadAuthSession({ env }) : suppliedSession;
+  return pendingWorkspaceValue(session?.pendingWorkspace);
+}
+
+export async function savePendingWorkspace(value, { env = process.env, expectedAccessToken } = {}) {
+  const pendingWorkspace = pendingWorkspaceValue(value);
+  if (!pendingWorkspace) return false;
+  const session = await loadAuthSession({ env });
+  if (
+    !session?.accessToken ||
+    (expectedAccessToken && session.accessToken !== expectedAccessToken)
+  ) {
+    return false;
+  }
+  const existing = pendingWorkspaceValue(session.pendingWorkspace);
+  if (existing && existing.id !== pendingWorkspace.id) return false;
+  await writeAuthSession({ ...session, pendingWorkspace }, env);
+  return true;
+}
+
+export async function clearPendingWorkspace(id, { env = process.env, expectedAccessToken } = {}) {
+  const session = await loadAuthSession({ env });
+  if (!session?.pendingWorkspace) return false;
+  if (expectedAccessToken && session.accessToken !== expectedAccessToken) return false;
+  if (id && session.pendingWorkspace.id !== id) return false;
+  const payload = { ...session };
+  delete payload.pendingWorkspace;
+  await writeAuthSession(payload, env);
+  return true;
+}
+
+export async function clearAuthCredentials({ env = process.env, expectedAccessToken } = {}) {
+  const existing = await loadAuthSession({ env });
+  if (
+    expectedAccessToken &&
+    existing?.accessToken &&
+    existing.accessToken !== expectedAccessToken
+  ) {
+    return false;
+  }
+  const recovery = durableRecoveryFields(existing);
+  const recoveryUserId = recoveryOwnerId(existing);
+  if (Object.keys(recovery).length === 0 || !recoveryUserId) {
+    await rm(getAuthConfigPath(env), { force: true });
+    return true;
+  }
+  await writeAuthSession({ ...recovery, recoveryUserId }, env);
+  return true;
 }
 
 export async function clearAuthSession({ env = process.env } = {}) {

package/src/capability-catalog.mjs

@@ -0,0 +1,7 @@
+export async function loadCapabilities() {
+  try {
+    return await import("@ornn/capabilities/cli");
+  } catch {
+    return await import("../vendor/capabilities/cli.js");
+  }
+}